Vulnerability Description
danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN, lock out operators, redirect OTHER_SERVER or PROXY_URL for SSRF, and trigger redeployment.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/huangxd-/danmu_api
- https://github.com/huangxd-/danmu_api/blob/5ef63a01bae7c4bad4dcd7bafbbcdcf33aa82
- https://github.com/huangxd-/danmu_api/commit/6e93478064a0ce4e7ed3bc2eae88adaad1b
- https://github.com/huangxd-/danmu_api/issues/531
- https://www.vulncheck.com/advisories/danmu-api-before-1.21.7-authentication-bypa
FAQ
What is CVE-2026-116485?
CVE-2026-116485 is a vulnerability with a CVSS score of 9.8 (CRITICAL). danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN ...
How severe is CVE-2026-116485?
CVE-2026-116485 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-116485?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.